CVE-2026-103358

HighCVSS 7.5

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

A Code Injection vulnerability in VillaTheme Email Template Customizer for WooCommerce allows code injection. Affects versions up to 1.3.4.

Risk Assessment

An attacker can inject malicious code, potentially leading to site takeover or unauthorized actions.

Recommendation

Update the plugin to the latest version and restrict permissions for users with template editing access.

Other vulnerabilities in Email Template Customizer for WooCommerce

CVE-2025-64200Medium
The Email Template Customizer for WooCommerce plugin by VillaTheme up to version 1.2.17 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the victim's browser.

Original NVD description (English source)

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS